Handling Multiple Table Inserts and Placeholders

Study Notes

When processing a purchase, insert a new customer into the Customers table and refer to the newly created CustId when inserting a purchase into the Purchases table
Using AUTO_INCREMENT, insert data in multiple tables, retaining the insert ID returned for storing in the related table

Placeholders are positions within prepared statements in which data is transferred directly to the database, preventing user-submitted data from being interpreted as MySQL statements
Using placeholders is the best and recommended way to interact with MySQL, providing security against hacking and SQL injection

Using PHP as an interface to MySQL to format query results for a web page
The process involves connecting to MySQL, selecting a database, preparing a query string, performing the query, retrieving results, and outputting them to a web page

Building forms involves creating a form for users to enter data, sending the data to a web server, interpreting the data, and taking action, which may involve a database.
A form must have at least the following elements: an opening and closing form tag, a submission type specifying either a GET or POST method, one or more input fields, and the destination URL to which the form data is to be submitted.

A simple form can be created using PHP, with the form data being submitted to a PHP script.
Default values can be offered to users in a web form, making it easier for them to fill out the form.

HTML forms allow for a wide range of input types, including text boxes, text areas, checkboxes, radio buttons, and more.

Handling user data is a security minefield, and it's essential to treat all user data with caution.
PHP arrays $_GET and $_POST are used to pass form data to PHP.
To sanitize user input, it's necessary to strip HTML tags, remove unwanted slashes, and escape quotes to prevent malicious input.
The strip_tags function can be used to remove HTML tags from a string.
The htmlentities function can be used to convert HTML into a format that can be displayed but not interpreted as HTML by a browser.
A PHP function like quote can be used to escape necessary characters and add quotes to the start and end of a string to prevent SQL injection.

Form data can be submitted using either the POST or GET method.
To submit a group of selections from a web form using a single field name, an array of values can be used.
To submit a form field without displaying it in the browser, a hidden field can be used.
The label HTML tag is used to encapsulate a form element and supporting text or graphics, making the entire unit selectable with a mouse-click.